CVE-2026-81904 Overview
CVE-2026-81904 is a missing authorization vulnerability [CWE-862] in Concrete CMS versions below 9.5.3. The content management system registered view assets for every sub-block inside a Stack, Container, or layout area without verifying whether the requesting user held permission to view that sub-block. An unauthenticated visitor could recover configuration values emitted by a restricted sub-block's asset registration hooks. Exposed values include items such as a site's configured Google Maps API key. Any sub-block type whose asset or header hooks output configuration values is affected.
Critical Impact
Unauthenticated attackers can extract configuration secrets from permission-restricted sub-blocks embedded in public Concrete CMS pages.
Affected Products
- Concrete CMS versions prior to 9.5.3
- Stack, Container, and layout area blocks containing restricted sub-blocks
- Sub-block types whose asset or header hooks emit configuration values
Discovery Timeline
- Vulnerability reported by Yonatan Drori (Tenzai)
- 2026-09-08 - CVE CVE-2026-81904 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-81904
Vulnerability Analysis
Concrete CMS renders composite content structures such as Stacks, Containers, and layout areas by iterating over their child sub-blocks. Each sub-block registers view assets through the framework's asset registry, and header hooks emit configuration values used by client-side scripts. The vulnerability stems from the framework registering these assets for every child sub-block without performing a permission check on the current request context.
Block-level permissions in Concrete CMS restrict which users can view specific blocks. However, the permission enforcement occurs at the block rendering stage rather than at asset registration. Sub-blocks hidden from an unauthenticated visitor still contribute their asset payloads to the page. Configuration values such as third-party API keys appear in the rendered HTML source, regardless of the block permission configuration.
Root Cause
The root cause is missing authorization [CWE-862] in the asset registration path for composite blocks. The framework treats asset registration as a purely rendering-support concern rather than a data-exposure boundary. As a result, view-permission checks that gate block output are not applied to the asset and header hook pipeline.
Attack Vector
An unauthenticated attacker requests any public page that embeds a Stack, Container, or layout area containing a permission-restricted sub-block. The attacker inspects the rendered HTML, JavaScript, or asset registration output for configuration values leaked by the restricted sub-block. No authentication, user interaction, or elevated privileges are required. The attack requires a specific configuration condition — the presence of a restricted sub-block that emits configuration values through its asset hooks.
See the Concrete CMS 9.x Release Notes for technical fix details.
Detection Methods for CVE-2026-81904
Indicators of Compromise
- Unauthenticated GET requests to public pages that embed Stacks, Containers, or layout areas with restricted sub-blocks
- Presence of third-party API keys or configuration secrets in rendered HTML from restricted blocks
- Anomalous scraping patterns targeting pages known to contain composite block structures
Detection Strategies
- Audit rendered output of every public page containing Stacks, Containers, or layout areas for configuration values that should be permission-restricted
- Compare asset registration output between authenticated and unauthenticated sessions to identify leaked values
- Review web server logs for unauthenticated clients retrieving pages that host restricted sub-blocks
Monitoring Recommendations
- Monitor outbound usage of any API keys embedded in Concrete CMS configurations for unexpected origins
- Enable request logging on the Concrete CMS instance and alert on scripted access patterns to composite-block pages
- Track version drift across Concrete CMS deployments to identify hosts still running versions below 9.5.3
How to Mitigate CVE-2026-81904
Immediate Actions Required
- Upgrade all Concrete CMS instances to version 9.5.3 or later
- Rotate any API keys, tokens, or configuration secrets that may have been rendered on public pages
- Inventory Stacks, Containers, and layout areas that contain permission-restricted sub-blocks emitting configuration data
Patch Information
Concrete CMS resolved this issue in version 9.5.3. The fix enforces sub-block view permission checks during asset registration for composite block types. Details are documented in the Concrete CMS 9.x Release Notes.
Workarounds
- Remove restricted sub-blocks that emit sensitive configuration values from Stacks, Containers, and layout areas rendered on public pages until upgrading
- Move sensitive third-party integrations that rely on client-side keys behind server-side proxies with request-origin controls
- Restrict public access to pages hosting composite blocks that embed permission-gated content while planning the upgrade
# Verify installed Concrete CMS version and confirm upgrade to 9.5.3+
php concrete/bin/concrete5 config:get concrete.version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
